3Com OfficeConnect WX1200 Instruction Manual

Part No. 735-9502-0008, Revision C
Published November 2004
WIRELESS LAN SWITCH AND CONTROLLER
MSS VERSION 3.0 RELEASE NOTES
Related Documentation
Please use these notes in conjunction with the following
documents:
■Wireless LAN Switch and Controller Quick Start
Guide
■Wireless LAN Switch and Controller Installation and
Basic Configuration Guide
■Wireless LAN Switch and Controller Configuration
Guide
■Wireless LAN Switch and Controller Command Refer-
ence
You can obtain the latest technical information for
these products, including a list of known problems and
solutions, from the 3Com Knowledgebase:
http://knowledgebase.3com.com
Software License Agreement
Before you use these products, please ensure that you
read the license agreement text. You can find the
license.txt file on the CD-ROM that accompanies your
product, or in the self-extracting exe that you have
downloaded from the 3Com Web site.
Points to Note when using the WX1200 and
WX4400
Follow these best-practice recommendations during
configuration and implementation to avoid or solve
issues you might experience.
System Configuration Best Practices
3Com strongly recommends that you use 3Com Wire-
less Switch Manager (3WXM) for archiving and version
control of network-wide wireless LAN switch configura-
tions. 3Com also recommends that you archive the
CLI-based configuration files of individual WX switches
by copying the configurations to a server.
Client and AAA Best Practices
Follow these best-practice recommendations during
configuration and implementation to avoid or solve
issues you might experience.
Get Clients and AAA Working First
The greatest majority of installation issues are related to
clients and AAA server (authentication, authorization,
and accounting) operation. 3Com recommends first
establishing a baseline of proper operation with a sam-
pling of wireless clients and the AAA server you plan to

2WIRELESS LAN SWITCH AND CONTROLLER MSS VERSION 3.0 RELEASE NOTES
use. Working out client and AAA configuration meth-
ods first provides valuable information as you scale
the deployment.
The selection of client and AAA server software will
depend heavily on the requirements of your deploy-
ment. First, decide which EAP Protocol you will be
using as that will restrict the available clients and serv-
ers. Each protocol has different advantages and disad-
vantages, which you will need to consider in your
deployment. For most enterprise deployments, 3Com
recommends using PEAP-MS-CHAP-V2 as the 802.1X
protocol. The following table compares the EAP pro-
tocols.
When testing and evaluating MSS, enterprises using
primarily Microsoft platforms are recommended to
use Windows XP clients running PEAP-MS-CHAP-V2
with a Windows 2000 or 2003 server running Inter-
net Authentication Service (IAS) as the RADIUS back
end. This provides a test environment that is quick to
set up and does not require additional third-party
software.
Wireless NICs
Most wireless NICs available now support 802.1X
authentication. The table below lists the NICs that
have been used successfully with MSS. The majority
were tested using recently available drivers using the
Microsoft native 802.1X client and a Microsoft IAS
RADIUS server. 3Com has not experienced any com-
patibility problems with NICs being unable to support
Protocol Advantages Disadvantages
PEAP-MS-CHAP-V2 ■Does not require
client certificates
■Compatible with
MSS EAP offload
■Native support in
Microsoft Windows
XP and 2000
■Broad support in
802.1X clients
■Username/pass-
word-based access
might not be as
strong as certifi-
cate-based access
EAP-TTLS ■Does not require
client certificates
■Broadest compatibil-
ity with user directo-
ries
■Requires third-party
802.1X client soft-
ware
■Username/pass-
word-based access
might not be as
strong as certifi-
cate-based access
EAP-TLS ■Strongest authenti-
cation using X.509
certificates.
■Native support in
Windows XP and
2000
■Broad supported in
all 802.1X clients
■Client-side certifi-
cates require full PKI
infrastructure and
management over-
head
PEAP-TLS ■Strongest authenti-
cation using X.509
certificates.
■Native support in
Windows XP and
2000
■Broad supported in
all 802.1X clients
■Client-side certifi-
cates require full PKI
infrastructure and
management over-
head
■Minimal advantage
over EAP-TLS
Protocol Advantages Disadvantages

Points to Note when using the WX1200 and WX4400 3
specific EAP protocols or specific RADIUS servers, so
we have only documented the differences in encryp-
tion type. Entries that have both Windows 2000 and
Windows XP listed together have the same results for
both operating systems. A result of Pass indicates suc-
cessful authentication and roaming with the listed
model and operating system. A result of Fail indicates
an inability to successfully complete authentication. A
result of NA (Not Applicable) indicates that the NIC
does not support the listed encryption type. A result
of NT (Not Tested) indicates that the combination has
not been tested yet.
Currently, WPA/CCMP (AES) encryption is supported
only when configured as the only cryptographic type
in service profile. Enabling dynamic WEP or WPA/TKIP
with AES on the same SSID can cause severe connec-
tivity issues as some manufacturers’ drivers do not
work properly when both encryption types are
enabled. 3Com recommends that you set up a sepa-
rate service profile for WPA/CCMP with a different
SSID for compatibility. If you are migrating from
Dynamic WEP to WPA/TKIP, 3Com recommends creat-
ing separate service profiles for each encryption type
and migrating users from one SSID to the other when
they are configured to use TKIP.
As new drivers are released by the manufacturers,
3Com expects general compatibility to improve.
Manufact
urer
Model OS WEP Mixed TKIP CCMP
3Com 3CRPAG175 XP Pass Pass Pass Pass
Buffalo WLI-CP-G54 XP XP NT XP XP
Cisco Aironet 350
MiniPCI
XP,
2000
Pass Pass NT NT
Cisco Aironet 350 XP,
2000
Pass Pass NT NT
Cisco Aironet
CB20A
XP Pass NT NT NT
Dell TrueMobile
1150*
XP Pass Fail Pass NA
Dell TrueMobile
1150†
2000 Pass Fail NT NA
Dell TrueMobile
1300
XP Pass NT NT NT
Dell TrueMobile
1400
XP Pass Pass Pass Pass
D-link DWLAG650 XP Pass Fail Pass Pass
Intel Pro/Wireless
5000
XP,
2000
Pass Pass NA NA
Intel Pro2100
(Centrino)‡
XP Pass Pass** NT NT
Linksys WPC54G XP Pass Pass Pass Pass
Linksys WPC54G
version 2
XP Fail Fail Fail Fail
Netgear WAG-511 XP Pass Fail Pass Pass
Proxim Orinoco Gold
8410
XP,
2000
Pass Pass NA NA
Proxim Orinoco Gold
8470
XP Pass Pass Pass NA

4WIRELESS LAN SWITCH AND CONTROLLER MSS VERSION 3.0 RELEASE NOTES
Driver Dependant Behavior
Some clients prefer a beaconed clear SSID to their
configured SSIDs. If you configure MSS to beacon a
clear SSID, some client adapters prefer this beaconed
SSID over the SSIDs they are configured to use. Con-
versely, some adapters can associate only with a bea-
coned SSID. Determine whether to beacon the clear
SSID based on the types of clients in the network.
Standby mode can prevent some clients from reasso-
ciating. If a laptop PC whose wireless adapter is asso-
ciated with a Managed Access Point (MAP) goes into
standby (hibernate) mode, the operating system can
either freeze or experience a Blue Screen of Death
(BSOD) when the laptop comes out of standby mode
and attempts to reassociate with the access point. To
work around this behavior, disable standby mode.
Alternatively, disable and reenable the wireless
adapter after the client emerges from standby mode.
If a client passes authentication but fails authoriza-
tion, the client might indicate that authentication has
succeeded but the MAP nonetheless disassociates
from the client. In this case, the client might indicate
that the network is unavailable. For example, this situ-
ation can occur if the certificate exchange is valid but
the requested VLAN or ACL filter is not available, or a
Mobility Profile™ denies service to the client. Once
the MAP disassociates from the client, the network
continues to be unavailable to the client through the
MAP for the duration of the 802.1X quiet-period
timer, which defaults to 60 seconds. An error mes-
sage indicating that a client has failed authorization
appears in the WX switch’s system log.
802.1X Clients
Properly preparing your clients for wireless connectiv-
ity is one of the most important things you can do to
ensure an easy rollout. Here are some guidelines for
preparing common 802.1X clients and platforms.
Windows XP Windows XP is a popular platform for
wireless clients because of its native support of
802.1X authentication and simplified configuration of
wireless networks. If you choose to use the 802.1X
client built-in to Windows XP, please note the follow-
ing:
Proxim Orinoco Gold
8480
XP Pass Pass Pass NA
Proxim Harmony
8450
XP Pass NT NT Pass
SMC SMC2835W XP Pass Fail Pass NT
Symbol LA-4121 XP Pass NT NT NA
* Dell TrueMobile 1150 drivers v7.86 and newer might not work with Dy-
namic WEP when you have WPA/TKIP enabled. If you experience problems
such as an inability to associate with the MAP, install the previous revision of
the driver, which is available from Dell’s support site.
† Requires a registry change to work properly; for more information, see
“Windows 2000”.
‡ Intel Centrino based chipsets might not associate with the SSID when
power-save mode is enabled. Future drivers or laptop firmware might re-
solve this issue, but until then 3Com recommends disabling power-save
mode completely in the driver properties for the NIC.
** The Intel Centrino based chipset has not been tested with WPA yet,
though Dynamic WEP does operate properly in a mixed TKIP and WEP con-
figuration.
Manufact
urer
Model OS WEP Mixed TKIP CCMP

Points to Note when using the WX1200 and WX4400 5
■Microsoft has extensive documentation on how to
configure and use wireless 802.1X authentication
in an Active Directory environment, published on
their website. You can start with Microsoft’s Wi-Fi
center at:
www.microsoft.com/windowsserver2003/technologie
s/networking/wifi/default.mspx
■Installing Windows XP Service Pack 2 is recom-
mended for all wireless clients as it includes several
important hotfixes.
■If you are not prepared to install Service Pack 2,
3Com strongly recommends that all wireless clients
use Service Pack 1a with the following hotfixes
installed:
■KB826942—This is the WPA Hotfix Rollup and is
available through Microsoft Update
■KB834669—This corrects an 802.1x client issue
which can cause system instability problems in
Windows XP. You will need to contact Microsoft
directly for this hotfix.
■If your network uses logon scripts, Active Directory
group policies, or your users regularly share their
laptops, you should enable computer authentica-
tion (also known as machine authentication) to
achieve full functionality over your wireless con-
nection.
■Download current drivers for your NICs from the
NIC vendor(s).
■If your wireless NIC’s driver includes the AEGIS pro-
tocol manager for WPA support, 3Com recom-
mends against installing it. Some drivers install this
automatically if you run the setup.exe utility to
install the driver. 3Com strongly recommends that
you update the driver manually using the driver
properties in the Network control panel instead of
installing the client manager.
■If you use computer authentication with different
VLANs for the Computer and User accounts and
do not have the WPA hotfix rollup (KB826942) or
Service Pack 2, you need to install Microsoft hotfix
KB822596. Otherwise, DHCP will not operate cor-
rectly after the user authenticates. You must con-
tact Microsoft technical support for this hotfix. It is
not available from their website. For more informa-
tion on computer authentication, see “Computer
Authentication”.
■If MD5 challenge is configured on a Windows XP
client for wired authentication, the quiet period
must be set to 0 to guarantee successful authenti-
cation. In addition, if the authentication is carried
out manually, the timeout value must be set to no
less than 30 seconds in order to allow the user
ample time to enter their username and password.
For example, to configure 802.1X on a WX switch
to allow these users time to log in, type the follow-
ing commands:
WX1200# set dot1x quiet-period 0
WX1200# set dot1x tx-period 30
Windows 2000 Many enterprises have a large
installed base of Windows 2000 laptops, making this
a common choice of platform. Windows 2000 Service
Pack 4 includes a native 802.1X client. If you choose
to use the 802.1X client built-in to Windows 2000,
please note the following:

6WIRELESS LAN SWITCH AND CONTROLLER MSS VERSION 3.0 RELEASE NOTES
■Microsoft has extensive documentation on how to
configure and use wireless 802.1X authentication
in an Active Directory environment, published on
their website. Most of this documentation is
geared towards Windows XP, but both operating
systems have many similarities in the client. You
can start with Microsoft’s Wi-Fi center at:
www.microsoft.com/windowsserver2003/technolo
gies/networking/wifi/default.mspx
■Installing Windows 2000 Service Pack 4 is required
for all wireless clients.
■Some clients might experience system instability
when using PEAP-MS-CHAP-V2 in an Active Direc-
tory environment. The primary symptom of this is a
message displayed after login informing the user
that the service svchost.exe has stopped unexpect-
edly. If you experience this problem, please contact
Microsoft technical support and request hotfix
KB833865.
■If your network uses logon scripts, Active Directory
group policies, or your users regularly share their
laptops, 3Com recommends that you enable com-
puter authentication to achieve full functionality
over your wireless connection.
■Download current drivers for your NICs from the
NIC vendor(s).
■Windows 2000 does not include a full implemen-
tation of the Wireless Zero-Config service from
Windows XP, so you will need to use the client
manager software provided with your NIC to con-
figure your SSID and enable WEP encryption.
When using dynamic WEP in Windows 2000,
select static WEP 128bit and enter any static WEP
key as a placeholder. This temporary key configures
the driver to use WEP to encrypt packets, and the
Microsoft 802.1X client then overrides the static
WEP key you entered with a dynamic key after you
authenticate successfully.
■If your wireless NIC’s driver includes the AEGIS pro-
tocol manager for WPA support, 3Com recom-
mends against installing it. Some drivers install this
automatically if you run the setup.exe utility to
install the driver. If you are unable to install the
client manager without the AEGIS component,
contact the driver manufacturer or download an
earlier version that does not contain the AEGIS
component.
■16-bit PCMCIA and built-in NICs (some 802.11b
cards in Dell, Toshiba, and other manufacturers’
laptop PCs) might require a registry setting to be
changed before they will be able to associate with
any SSID. Microsoft Knowledge Base article
327947 documents the changes necessary to
resolve the problem. Multi-band cards (A/B or
A/B/G) are generally 32-bit and do not experience
this problem.
■If you use computer authentication with different
VLANs for the Computer and User accounts, you
need to install Microsoft hotfix KB822596. Other-
wise, DHCP will not operate correctly after the user
authenticates. You must contact Microsoft techni-
cal support for this hotfix. It is not available from
their website. For more information on computer
authentication, see “Computer Authentication”.
■If you experience a delay in receiving your DHCP IP
address wirelessly while using 802.1X authentica-

Points to Note when using the WX1200 and WX4400 7
tion, you might need to install Microsoft hotfix
KB829116. You must contact Microsoft technical
support for this hotfix. It is not available from their
website.
Funk Odyssey ■The Funk Odyssey client is required
when you require WPA support on Windows 2000,
or when you need to authenticate to an LDAP
backend database that does not support
MS-CHAP-V2 over LDAP. If you choose to use this
client, please note the following:
■Download the latest version from Funk’s website
at: www.funk.com
■Be sure to turn off Wireless Zero Config in Win-
dows 2000 by disabling the service.
■If your wireless NIC’s driver includes the AEGIS pro-
tocol manager for WPA support, 3Com recom-
mends against installing it. Some drivers install this
automatically if you run the setup.exe utility to
install the driver. 3Com recommends that you
update the driver manually using the driver proper-
ties in the Network control panel instead of install-
ing the client manager.
Macintosh OS/X ■OS/X Version 10.3, also known
as Panther, includes an 802.1X client that supports
Dynamic WEP and WPA/TKIP. If you choose to use
this client, please note the following:
■The Panther client will only connect successfully to
an SSID which is only dynamic WEP, or only
WPA/TKIP. Any other configuration involving WEP
with WPA enabled or AES is not supported by the
current Panther client. If you need to run both
WPA/TKIP and Dynamic WEP at the same time you
must configured separate service profiles for each
encryption type in order to maintain compatibility
with Macintosh clients.
■The Panther client requires you to specify the inner
and outer PEAP-MS-CHAP-V2 usernames in sepa-
rate areas. Depending on your AAA backend, both
usernames might require a domain prefix in the
form of DOMAIN\username.
Computer Authentication
Windows clients support 802.1X authentication of
the computer itself. This is called computer authenti-
cation (also known as machine authentication). Com-
puter authentication is useful when you want your
computer to be active on the domain even when no
users are logged in to the computer. Some features of
Windows XP Professional and Windows 2000 Profes-
sional work correctly only with an active network con-
nection to the domain controller enabled before a
user is logged on to the PC. Using computer authenti-
cation ensures that this network connection is estab-
lished during the boot sequence, providing a wire-like
infrastructure that allows you to use the following
features on a wireless network. The following table
lists Microsoft networking features that require com-
puter authentication.
Feature Scenario Requiring Computer
Authentication
Active Directory com-
puter Group Policy
Computer–based Group Policy is applied
during computer start up and at timed
intervals—even when no on is logged in to
Windows.
Network logon scripts Network logon scripts are run during initial
user logon.

8WIRELESS LAN SWITCH AND CONTROLLER MSS VERSION 3.0 RELEASE NOTES
Configuring computer authentication on the client is
simple, though it requires the use of the Microsoft
802.1x client built-in to Windows XP and Windows
2000. Keep the following information in mind when
configuring computer authentication on Microsoft cli-
ents:
■To enable computer authentication, go to the
Authentication tab where you normally select your
802.1x authentication method and enable the
checkbox labeled Authenticate as computer when
computer information is available.
■The authentication protocol that is configured for
your user accounts will also be used for the com-
puter account.
■If the EAP protocol you are using requires client
certificates, you must use the Microsoft Enterprise
Certificate Authority built-in to Windows 2000
Server and Windows Server 2003 to generate
Computer certificates for PCs on your active direc-
tory domain. Microsoft Knowledgebase Article
KB313407 explains how to enable the automatic
distribution of computer certificates through
Active Directory.
■If the user and machine accounts use different
VLANs, you must install hotfixes on the client PCs
to enable them to DHCP for a new IP address
when the user authentications. Windows XP
requires either the WPA Rollup Hotfix (KB826942)
or Hotfix KB822596. Windows 2000 requires
hotfix KB822596.
■Using PEAP-MS-CHAP-V2 with computer authenti-
cation will allow users who have never logged on
to a PC authenticate wirelessly without having to
login to the PC over a wired connection the first
time. EAP-TLS still requires the user to connect to
the network over a wired connection to generate a
profile on the PC and a user certificate.
Enabling computer authentication also requires minor
reconfiguration of Active Directory and IAS. Please
note the following when configuring computer
authentication on an active directory domain:
■You must grant dial-in access for the computer
accounts in Active Directory that you wish to
enable computer authentication on. If the tab to
configure dial-in access does not appear, follow
the directions in Microsoft Knowledgebase article
KB306260.
■Review your remote access policies in IAS to insure
that the computer accounts have appropriate
group membership to allow them to match the
proper policy.
Systems management
agents
Systems management application agents
such as those that come with Microsoft Sys-
tems Management Server (SMS) frequently
need network access without user interven-
tion.
Remote Desktop Con-
nection
Computers are accessible from Windows
Remote Desktop Connection when no one
is logged on to Windows.
Shared folders Files and folders shared from a computer
are still available, even when no user is
logged on.
Feature Scenario Requiring Computer
Authentication

Points to Note when using the WX1200 and WX4400 9
Computer authentication also requires specific con-
figuration considerations on the WX switch:
■The username of a computer authentication con-
nection will be in the form of host/fully-quali-
fied-domain-name, for example
host/bob-laptop.3Com.com or host/tac1-lap-
top.support.3Com.com. This username is the same
regardless of the configured protocol
(PEAP-MS-CHAP-V2 or EAP-TLS). An appropriate
userglob would be host/*.domain.com where
domain.com is the Active Directory domain name.
Alternatively, in a smaller deployment you could
use a userglob of ** and have both user and com-
puter authentication go to the same RADIUS
server.
■PEAP-MS-CHAP-V2 offload mode is not supported
with computer authentication. You must use
pass-through 802.1x authentication policies with
computer authentication.
AAA
The following table lists the AAA servers and configu-
rations that have been tested with MSS. Tests were
performed to a local user database in most cases, and
additionally to Microsoft Active Directory and LDAP
with specific protocols as noted in the table. The tests
were initially performed using Dynamic WEP, though
subsequent testing has revealed no noticeable differ-
ences in RADIUS compatibility when using WPA.
A result of Pass indicates that the combination is sup-
ported by MSS. A result of NA (Not Applicable) indi-
cates that the RADIUS server tested does not support
the feature. A result of Fail indicates that the RADIUS
server does not interoperate with MSS for that fea-
ture. A result of NT (Not Tested) indicates that the fea-
ture was not tested.
RADIUS Testing notes Single-Sign-On is defined
as clients being able to use the same username and
password for 802.1X authentication that they use to
Configuration
RADIUS Servers Tested
Win
2000
IAS
Win
2003
IAS
Funk
Steel
Belted
Radius
Cisco
ACS
Free-
Radius
(Linux)
PEAP-MS-CHAP-
V2
Pass Pass Pass Pass Pass
PEAP-MS-CHAP-
V2 Offload
Pass Pass Pass Pass Pass
EAP-TLS Pass Pass Pass NT Pass
EAP-TTLS NA NA Pass NA NT
Single-Sign-On
Active Directory
&
PEAP-MS-CHAP-
V2
Pass Pass Pass Pass NA
Single-Sign-On
LDAP & EAP-TTLS
NA NA Pass NT NT
MSS VSAs Pass Pass Pass Pass Pass
Mac-based
authentication
Pass Pass Pass Pass Pass
Microsoft Active
Directory com-
puter authentica-
tion
Pass Pass NA Pass NA

10 WIRELESS LAN SWITCH AND CONTROLLER MSS VERSION 3.0 RELEASE NOTES
authenticate with network services and logon to their
local PC.
■A Pass result for 3Com VSAs indicates that the
VSAs were able to be added to the RADIUS server
manually. Future versions of Steel Belted RADIUS
and FreeRadius are planned to include standard
definitions of the 3Com VSAs.
■Funk Steel Belted Radius version used for testing is
4.53
■Windows 2000 with Service Pack 4
■Cisco ACS 3.2 or later is required to support
PEAP-MS-CHAP-V2
WPA
3Com conducted WPA compatibility testing with a
variety of NICs. See “Wireless NICs” for complete
details of the results. If you choose to use WPA to
secure your wireless network, please note the follow-
ing:
■CCMP (AES 802.11i draft support) is supported
only when it is the only encryption type enabled on
that SSID. Enabling TKIP or Dynamic WEP on the
same SSID with CCMP can cause serious connec-
tivity issues as most clients do not properly support
this configuration. 3Com recommends that you
create a separate service profile and SSID for
WPA/CCMP.
■Enabling TKIP and Dynamic WEP on the same SSID
is not recommended. This configuration forces the
group key (multicast/broadcast key) to use the
lowest common encryption type, in this case
Dynamic WEP. Additionally, compatibility with
wireless NICs is reduced.
■Downloading the latest drivers for your wireless
NIC is strongly recommended. See “802.1X Cli-
ents” for specific information on installing drivers
for your operating system.
■When a session key is changed, Microsoft WPA cli-
ents can sometimes incorrectly start using the new
key before the end of the four-way handshake that
is used to establish the key information. This issue
can occur when the session timeout for the client
session expires. As a result, the MAP rejects the cli-
ent’s re-association attempt because the key infor-
mation presented by the client is invalid. If you
experience this issue, clear the Session-Timeout
attribute on the affected users. The WX switch will
not force a reauthentication of WPA/TKIP and
WPA/CCMP users periodically like it does with
dynamic WEP users.
■Do not use the set service-profile
shared-key-auth command in a WPA configura-
tion. This command does not enable PSK authenti-
cation for WPA. To enable PSK for WPA, use the
set service-profile auth-psk command.
■Use one WPA authentication method per SSID,
either 802.1X authentication or preshared key
(PSK) authentication, but not both.
Security—best practice when mixing encrypted
access and clear access
It is possible to configure a RADIUS server or a WX
switch’s local authentication database so that a user
with encrypted access and a user with unencrypted